Unitree G1 humanoid robot flaws disclosed in late August allow an attacker standing within Bluetooth range to take root control of the $20,000 machine without pairing, a password or any owner interaction.

 

The two vulnerabilities, tracked as CVE-2026-76639 and CVE-2026-76640, each end in root code execution on the robot's locomotion computer. One of them is wormable.

 

Security researcher Olivier Laflamme, who publishes as Boschko Security, spent roughly three months on a G1 EDU unit he received in April and released the full write-up on 27 August. Unitree paid him a $5,000 bounty and closed part of the chain before publication.

 

How the Unitree G1 Bluetooth Attack Works

 

CVE-2026-76640 is a chain of five separate weaknesses that begins at a Bluetooth Low Energy characteristic labelled 0xFFE2. That characteristic accepts writes from unpaired devices, so no handshake with the owner is required.

 

Laflamme's write-up, which he named UniBLEed, walks through the sequence:

 

  1. An unpaired device writes a bootstrap opcode to BLE characteristic 0xFFE2
  2. The robot returns its AES key wrapped inside an RSA blob
  3. Unitree's cloud endpoint decrypts that blob for any free account, with no ownership check
  4. The recovered key unlocks the robot's Wi-Fi provisioning interface
  5. A 121-byte pre-shared key injected into an unquoted heredoc forces an unsafe wpa_supplicant configuration
  6. A 1,050-byte write into a 500-byte buffer in btgatt-server corrupts the event loop into calling system() as root

 

The cloud decryption step is the pivot that makes the rest cheap. Laflamme describes it as a decryption oracle, because the server would unwrap any G1's key for a stranger holding a free account.

 

That single AES-128 key covers both the Bluetooth protocol and the WebRTC signalling channel. Recovering it collapses two separate trust boundaries at once.

 

"Root on a $20,000 humanoid robot from Bluetooth range... wormable, meaning once one G1 is compromised, it can spread the same exploit to the next G1 in range, and so on indefinitely."

 

Laflamme wrote that in his disclosure, and he demonstrated the spread across two robots sitting in the same room.

 

A Second Chain Through the Robot's Chatbot

 

CVE-2026-76639 needs network adjacency rather than Bluetooth proximity. It abuses the knowledge-base upload in chat_go, the G1's onboard chatbot service, which validates filenames loosely enough to permit path traversal.

 

An attacker writes a file into a directory that the bashrunner service already trusts, restarts bashrunner and sends five DDS messages to obtain an unauthenticated root shell. The trigger path runs over a WebRTC-to-DDS bridge that asks only for the device's hardcoded AES key.

 

Laflamme tested firmware versions V1.5.1.1 through V1.5.2 on the G1 EDU, the research variant sold to universities and corporate labs.

 

What Unitree Patched and What It Has Not

 

Unitree's security team engaged during the disclosure window and added account-to-robot binding verification to its cloud API by 6 August. That closes the oracle that made key recovery trivial for anyone with a free account.

 

Laflamme described the vendor's handling as close to ideal, a notable contrast with earlier reports about the company's response to outside researchers. The bounty was split $4,000 for the Bluetooth chain and $1,000 for the chatbot chain.

 

The deeper problems sit in firmware rather than in the cloud. The missing pairing requirement on the BLE interface and the buffer overflow in btgatt-server both need firmware updates, and no fixed release had been publicly confirmed at the time of disclosure.

 

Echoes of the 2025 UniPwn Disclosure

 

This is the second time in a year that Unitree's Bluetooth provisioning surface has been broken open. In September 2025, researchers Andreas Makris and Kevin Finisterre published UniPwn, an exploit built on hardcoded encryption keys that affected the Go2 and B2 quadrupeds alongside the G1 and H1 humanoids.

 

"An attacker could do much more sophisticated things: It would be possible to have a trojan implanted into your robot's startup routine."

 

Makris made that warning to IEEE Spectrum at the time. Unitree said publicly that it had begun addressing the concerns and had completed the majority of the fixes.

 

The 2026 chain reaches root by a different route, but it starts in the same place: an unauthenticated Bluetooth configuration interface exposed to anyone standing nearby.

 

Exposure Across Shared Labs and Robot Fleets

 

The G1 EDU is a teaching and research machine, which means it usually lives somewhere with other G1 EDUs. Multiple units in one room is the normal deployment pattern, not an edge case, and it is exactly the condition a wormable Bluetooth exploit needs.

 

Background Reading

 

Unitree's installed base is also growing fast. The company raised about $904 million in a Shanghai STAR Market listing in August, and its shares surged on their trading debut, leaving it with one of the largest deployed fleets in humanoid robotics.

 

Until pairing enforcement and a hardened btgatt-server ship, owners running V1.5.2 or earlier are left with operational fixes: apply Unitree's latest firmware, keep research units off shared wireless networks, and treat Bluetooth range as an untrusted perimeter rather than a physical one.